PkgSeer

Vulnerability GHSA-g5vr-6pgg-74qv

Low Risk

2 months ago

Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint

v10.11.0+incompatible - v10.11.17+incompatible and v11.7.0+incompatible

Summary

Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint

Details

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Mattermost doesn't validate file ownership and access control in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5817

Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5818

Mattermost doesn't archive the channel before removing persistent notifications in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5820

Mattermost doesn't validate user-supplied input in API request handlers in github.com/mattermost/mattermost-plugin-github

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5833

Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5835

View all vulnerabilities for these packages

Impacted packages

github.com/mattermost/mattermost-server

Timeline

Published

2 months ago

Last Modified

1 day ago